Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11-07-2024 17:38
Static task
static1
Behavioral task
behavioral1
Sample
3a1d8f120744cf2f18070aa5092d0163_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3a1d8f120744cf2f18070aa5092d0163_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3a1d8f120744cf2f18070aa5092d0163_JaffaCakes118.html
-
Size
6KB
-
MD5
3a1d8f120744cf2f18070aa5092d0163
-
SHA1
86eba5879ea97d9d846d95c86ba633364c70bee6
-
SHA256
d82fb70b461997437c27338c6f20b21e979a02609c3027107d94dd2b87e64c9c
-
SHA512
a6f950b22f6ea819210e935bb5e0cdfe698a211ab025c2fb413ad8ed28d8e884e38b1e41d1579f5cb5d59b3d9eaf3eb1274ddc63538deba1edb376f1ba575369
-
SSDEEP
96:uzVs+ux7R2fLLY1k9o84d12ef7CSTUEPcEZ7ru7f:csz7RWAYS/1b76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30521347b9d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426881399" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000002e7165316453fa99676ca252ea4575a14de02a8cd2321b56e6f26dce42730d6000000000e80000000020000200000001699c198571d82d872148fb35464f00c7376a16ac2175ca81a082d0b20f08ab7200000003b72960b0ec938d4786d798fcec00f96486f93629d2bc1a68f11ebc9af07234240000000fefed3c0d00ba552d527b18411b9662fef7f8bcbf71c862a4b1145ce613d8dc3857accf6eea737ccd9a4dd884fd8e0b506f13f69074f892eb3bb808f2fb7d310 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70506B11-3FAC-11EF-9AA1-FE3EAF6E2A14} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000b40f9eb1dac01b1014a7fec34ea507a6b676d03e09daf0add276a619904e49f9000000000e8000000002000020000000758b6d4e7c27dc7faa3a423abf7fa601eb8c41aaf1936a013e614b21e336500890000000795432a556df20f89a99dc255c600841a3290100e3defde4422b07a0588167a6041be6545d52c120a97e342ea788df0d006388a08d11edd0f9dd93d396de25d479b44a5542e3fccc66f3083c05c32d45272b06b9ebe17dd655172d6e14df4b6d34c4170cadcc8a4116eb0ecedf6f905575b52daf0d5eae790478ff02ce2f353463234c9d5bd880268a798f3ffe10c87240000000b8a8541b75624ac052c7391c5822d7670d06a9d7a159a548e032b553dadfff58404423736bf9758790fde18533f909dd1a50d1d722cbe05b98ea1f7eacf82649 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2512 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2512 iexplore.exe 2512 iexplore.exe 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2352 2512 iexplore.exe 30 PID 2512 wrote to memory of 2352 2512 iexplore.exe 30 PID 2512 wrote to memory of 2352 2512 iexplore.exe 30 PID 2512 wrote to memory of 2352 2512 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a1d8f120744cf2f18070aa5092d0163_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ed0d1a9cc720f5eb0ef980756827ebb
SHA195cc485ab1f08b75b6ab1a45959254b407b889ed
SHA256698c8f6505340b086085a03ab550e8454d3ee4c9d4656e38b1ca7805e79d7c50
SHA512956591ebdf9749471b9e6f758ecacbf66570258bfb278ceaf8d6ab75364620bb23b821322a99c9a6934745b542e0a36f22471bc31c1f2379754180f8671656f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc77d14a976f95730f9833fe020ef60e
SHA1a4d1197ea6a71b8e288c9ea03392025e2aa76136
SHA256c83a42aed721f225a6e3ae024d7d0211640ae49e2d83a33cac88b2937d1a0229
SHA5128ca0e66426750df2adedceb751201fe496559d93a3d348b5176456092c6fc834050c48362bc676a5987027970548cc0fe3280f2d4365f5410055ef7b09009b54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb02e48af4619a91a25533fef50f0d33
SHA13efe3a2ff218e632a8820c0efd56a1299dc637a7
SHA256417d470a822f80f6f732323d656a73afe179d43d11c454260ece2901a0c98a1a
SHA512b1b1108406ca2240f08b94e818eae55a6bd795d071faaa515ad7c3e08f875612c9c0603eb744011deef2222c690c64e1e4b9ad7cb1feeb0256460dec8ffbef44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba8b9fb316b8ad17949503539758db5d
SHA1f2038147cf994a10ebe1138fc21bd3eeb1cec54a
SHA256072011a48beebf1190afa2585289e78943fb0f68b9ac86c6c5ab7789bf72b9a8
SHA5123e83bdebb70181ac0d1f6572531defa0333c0ba0b02372b0d351da86a5d20367aa83851065529f29dbb8a007286153da1e640bce6cabe38b29e9b9fe2794aaad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539bf7f855d32e3834660424aa005326d
SHA1224f3151609e952d7d553e06f7b8b7748dbe8c44
SHA25603391f63d46f91af46c8427cfd947e699a72d4b1b0344abcdca076d8658377d5
SHA512f8e6240bd73c3c58aaa571da1f79c8d0534f1718182ebeb2036ae6e95fe7672836743dba48287f18f91cb6246c773a46aaaa45cfadeb42960371794c912284ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569569aab92f03b85d84c1b80c2bd5ed1
SHA15a0fa8adc1f16fa203c7027d51bfd35cf18c2012
SHA2562bf68df9646b49fdb94e5f4c6304779fef733c3557cee0c98145ff5af50086b2
SHA51209963e151a646ea46a056868d26e4f377ed47b1a992eda580ac6a48838d2718f65ebb2938e6cb77ad9f559595895581fea944e1abf97cad38ac346c6344b242d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa7bfc7e02bb3f004739d344144ec43a
SHA1da380e5edcf050426f579ed1ad10072cecb07a99
SHA2568d643de20a5057c9cf895e306a3e4b48c53ed7d9f481bf430af85904d276c861
SHA512c06a235b4f008f34f9e74bc4457cfabe3a9dcb299cfe3a138f1753b8c008e5e323d237783f7099f0dfb7dd2603301ea625b63ee8572c1ffad2c93c1d04c13b8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc28d1777262b5270b18148d848ae6e5
SHA171c5e4bf584c84cfd52e5e682026069dc427d207
SHA2562855cf521a4c08724c49f589016cb3f7ec5000faf4d80b6ff879eaadef317bbd
SHA512d18a949ced828f092f0adc4c9788e510abf7d81837f281f6c8f91119a7862b0b408509b6648540278e50d6aa8bb5f062be6f436c2e7a004c37fef26b1c352095
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53583d63a882c7a35684041e0f1f73f59
SHA18e2b1a57188e6b6a68284ee215f8b4372b58aedb
SHA256b4a2274444da39d0c53a33832e96e2c1ac8a4b3cda78f902402ee5ab0162853f
SHA512b74ff52bde801df803c5be1103f881bd4d62619267f62c06143ca889ac260c7b445b9afa2889cc4098b9bef5959dc866fb6dc1931f9d0991ed2bbe9b5162af38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fda5fdda8aad7862ab369f31424bfae6
SHA1f967b33723d96f394a6973a6bbd6557f728bef42
SHA256b889d6945b6d9b2bf59bd920636c491fa2b9e5275d2707ef297275e496a935dc
SHA512783846fe7988c05aaff1bc2a84a87a835f241800bb6e2b881b650e92e49db64f38e9b4fad51e390bb3e4e78c7b6f91c6e56c96d377372306dc1494d5e805963e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c670044398d1d949f0d5d4efc8d05d1
SHA1d2d110f2082fcc026e75e5aa594362a2fbccd150
SHA256850a699d6df81ec7c7042dc4919eef2b1a477673fb4cdd2f6c9466334d4f4ef0
SHA5129eb696415fd8defd69efa99730106dd839a2605d56c8b0ccb13cdb158a0639c9e43b0c07875e060ec86b9a7b8564ca71950bc4573ae4d77297a7b8a510e4e21d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597fe97bb58ca54771aa7448a665a06ec
SHA1cc568f31b93195a1d54aeb9fc49a4140773b85b1
SHA25613ab86ef06b30f6ae0e74abecc973b40e04dd5dddad6c53926cf1462062c8219
SHA512d95b7a432997eb05b59af2d086c6943184def5ab841d4597c702bf54075d10860323fbc7b9d84669fd0b884a4d5d91c59282e3c865d753217cd44a978dc0ad59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566e090e316eee2c002d0fed680ca1826
SHA185184f1aa4beb4e6ad305d52e923a59f998b59d2
SHA256b44fb2c41e1310b538fbc900d5fd6729a97092a2521ec36bb9661fd8c210bbcd
SHA51294a17f5f80b1b77a63ca2c58b974d8f5f02fbad2217332833901f90e5ec2bf3378c44bad7641d9b486276737648850ca638c1d8f8914e26f514f06085b5df15a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575d9498923408e74a07f90a3847eda29
SHA19c189e70e363c51487b8637abdf142f30073d46f
SHA25680a9e50eafde1a65d3bf94c6a8d4f2a7738b6325cbd9b1bc10730968f5ce947f
SHA512afd7d6407d350331ca737e41b52a07d2385bdde2dfe8385adb9c144aba5b0c2cf28ad91670d336bc2da9f40c63fe819c41fb94f8576e2dc168bc22a6a9ca4e1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594b8a7a4be82d75a10330bbc131b3b4b
SHA1e754062e1e747f2a09c114281086a2de951a0934
SHA256cbfddb4cd9a3e2a3bcfb84d1ceb3faf02e5dfbe22f06b27956f449c99855d31e
SHA51273d0c590d3012c92c9792dacfa7e929519a6a82acd1af3caa6f58785398b41c1ab15077d8fe466cb83fccc39194921631a07f6c0fb941f72fe508ed1ca443dab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543e4a8d8596f246ce4bd52cde44fa4f3
SHA128b692a8a2dd22d46eb4e4f1bf0064bb8c250ad4
SHA256c8ff2f53df9eae6a09eb2269aad93b4fd91e58b618701559515d8c5c5bea0f29
SHA512f63ada27d15381043822d4c6793c8e76d307891949c87fec05dbf253f6600c8205ec5b81a0eb2b2945fbfd341c207e9d3e01544d65327c0195fbb208a9d02105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525b167d3694d365a8b7b70332900d720
SHA1a8bc836a8db96d26ae63a5d8e832e6184946463d
SHA25628c5df8b3678df1a9023ba87435aeffc1ec479991847930c5c47f095f0c50d65
SHA512d74dc3a5aebf5c04e7bb3427adfe2f0663f144a413eba1eb40fac1316c88ebd61974112b07c981a3546c8be8c50493c19e777eb72c9218e46308d7a5106dbb6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9eec69b318d03dc826b3fe7990e1d61
SHA17f718c64576843eb1b302751671daf052c439d77
SHA2568fd42da8eaa1a03336afaa17ae40965f3da7fb69e8afec61048256bac9dd1493
SHA512b1bde72e01b25f78e8ef624e8fac7441a201e37dd3f1b38f352bec9392bc9170807a007d09feca950856d0b03157b3fb5c236b9d66ff6076752998b519c6197d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a66f5b2b625c2860f9dced61316ee63
SHA12de7a8d7dd328ce089af57d6dcb587250c42a385
SHA256061017f1f1c8878bbc7dde908cccf8f855f4bda0ee0eebfa603c891294bce902
SHA5126984657e35b006162e4c43450295aead2bc2231708d54d6fa1c432b3522bc108a6e1519f2e4bc0b1f266ddf67df3817b105e925364516bf6f874f624de16b39e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b